Outlook OST vs PST Files for Offline Forensics

312-49v10 By islever Editorial Last updated

Email and Social Media Forensics

Short answer

A Investigator should target .ost files located at C:\Users\%USERNAME%\AppData\Local\Microsoft\Outlook for deeper analysis.

Question

In an email crime investigation, the forensic investigator analyses a computer using the Microsoft Outlook application. The investigator knows that Outlook stores email data in both .pst and .ost file formats. They want to focus on the files that hold the email data even when there is no internet connection. Which files should the investigator target for a deeper analysis?
  1. Offline Storage Table (.ost) files located at C:\Users\%USERNAME%\AppData\Local\Microsoft\Outlook Correct Answer
  2. Email data located within Mozilla Thunderbird and Apple Mail email clients
  3. Archived email files in .pst format located via File —> Options —> Advanced —> AutoArchive Settings
  4. Personal Storage Table (.pst) files located at C:\Users\%USERNAME%\Documents\Outlook Files

Key Takeaways

The question tests knowledge of Outlook storage mechanisms, with the common trap being confusion between OST (cached online profile) and PST (local archive/export).

This question tests the ability to distinguish between Outlook's OST and PST file formats in the context of email forensics. The page establishes that OST files are the correct target for analyzing cached offline data.

Common mistake: Candidates often select PST files because they represent local storage, failing to recognize that OST is the specific format used by Exchange/Online accounts to cache data for offline access.

Expert Analysis

Why the Answer Is Correct

The correct answer is A. In Microsoft Outlook, an Offline Storage Table (.ost) file is created when a user configures an Exchange or Microsoft 365 account. This file acts as a local replica of the mailbox on the server, allowing the user to access emails, contacts, and calendar items even without an internet connection. For a forensic investigator, this is the primary location to find recent email activity that was viewed or drafted offline.

Why the Other Options Are Wrong

Option D (PST files) stores manually exported or archived emails, not the automatic cache of an online mailbox. Option C refers to AutoArchive settings which move old mail to a PST, but does not describe the real-time offline cache. Option B is irrelevant as it discusses different email clients entirely.

Community Comment Notes

The community consensus strongly supports OST. User 'jingu_bingo' referenced CHFI materials confirming OST availability without internet. User 'Elb' noted that OST updates upon reconnection, highlighting its role as a synchronized cache. Another comment explained that OST contains automatically cached emails unlike PSTs.

Exam Strategy

Always associate 'Exchange/Online Account' with OST and 'Archive/Export' with PST. When a scenario mentions accessing email 'offline' while still part of a corporate environment, look for OST.

Frequently Asked Questions

Why is PST not the answer for offline access?

PST files are used for archiving or exporting personal folders, whereas OST is specifically designed to cache online mailbox data for offline use.

Where are OST files typically stored?

They are usually found in AppData\Local\Microsoft\Outlook, distinct from PST files which are often in Documents or custom locations.

More 312-49v10 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Elb 👍 2 Answered A
    As emails, contact, calendar, and other data are not taken off the server such as pop accounts, users can access their emails even when they do not have an Internet connection. All mailbox information is updated when the connection is revived.
  2. jingu_bingo 👍 2 Answered A
    CHFIv11 page1193: "...users can access...do not have an Internet connection"
  3. 044f354 👍 1 Answered A
    Answer: A Explanation: (A) ✅ OST files store offline email data for Outlook, crucial for analysis without internet. (B) ❌ Irrelevant; focuses on different email clients (Thunderbird, Apple Mail). (C) ❌ Archived PST files are stored separately and may not contain the latest offline data. (D) ❌ PST files store manually exported emails, not automatically cached offline emails. ----- If you agree, please UPVOTE. Each time you upvote someone with a yellow "SELECTED ANSWER: " banner (like me) your vote is added to the Community Vote Distribution, which helps the community by crowdsourcing correct answers.
  4. Elb 👍 1
    A < https://www.techtarget.com/whatis/definition/OST-file-ost#:~:text=OST%20stands%20for%20Offline%20Storage,view%20emails%20online%20or%20offline.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Analyzing Password-Protected Packed Malware

S-grade

Steganalysis for Steganography Attack Detection

S-grade

File Sector Allocation and Fragmentation in Forensics

S-grade

Which Tor Relay Should Investigators Focus On to Trace Data Origin?

S-grade

← Back to 312-49v10 Study Guide